This Privacy Policy describes how AllyGPO, LLC, its affiliates, and its business lines, including AllyRetina, AllyOncology, AllyAnalytics, and AllyIQ (collectively, “AllyGPO,” “we,” “us,” or “our”), collect, use, disclose, and retain personal information in connection with the activities described below.
This Privacy Policy applies to personal information collected through:
We refer to these activities collectively as the “Services.”
AllyIQ and other AllyGPO products may process practice, purchasing, utilization, inventory, patient, or other member-provided data under membership agreements, product agreements, business associate agreements, data-use agreements, and other applicable contracts. This Privacy Policy does not replace or modify those agreements or independently authorize uses of information governed by them.
Personal information collected in an employment, contractor, or applicant context is addressed in applicable workforce and applicant notices, including our California HR Data Privacy Policy. This Privacy Policy applies when those individuals interact with the Services outside that context.
The Services are intended primarily for users in the United States. Our Website Terms of Use apply to use of the public website.
“Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an individual or household. It does not include information excluded from that definition under applicable law, such as lawfully deidentified or aggregated information.
The information we collect depends on your interaction with us:
| Category | Information involved |
|---|---|
| Identifiers and contact information | Name, email address, telephone number, account or user identifier, and online identifiers associated with website use and advertising audiences. |
| Professional and business information | Employer or practice name, job title, specialty, professional role, business contact information, and information concerning your or your organization’s relationship with AllyGPO. |
| Account and authentication information | Username, password or other authentication credentials, access permissions, account status, and information used to administer or secure an account. |
| Business, event, and program information | Information concerning memberships, products, services, programs, inquiries, registrations, attendance, preferences, and other business interactions with AllyGPO. Event information may include travel, dietary, or accommodation requests provided in connection with the event. |
| Communications and submitted content | Emails, form submissions, registration responses, support requests, correspondence, and other information you provide when communicating with us. |
| Internet and website activity | Website visits, pages viewed, interactions with website content and advertising tags, referring sources, conversion activity, and browser or device information associated with use of the Services. |
| Audio, visual, and similar information | Event, meeting, and webinar recordings and photographs, as described in applicable event materials, recording notices, or other terms. |
| Sensitive personal information | Account login credentials and information voluntarily provided for a requested event accommodation that qualifies as sensitive personal information under applicable law. |
Please do not submit patient names, medical information, protected health information, or other sensitive patient data through general website forms or business-inquiry channels. Protected health information that AllyGPO processes as a business associate is governed by HIPAA, applicable business associate agreements, and other relevant agreements and notices.
We collect personal information from:
We use personal information to:
We disclose personal information to the following categories of recipients, as applicable to the information and interaction involved:
We disclose information among AllyGPO affiliates and business lines for the purposes described in this Privacy Policy.
We disclose information to organizations that perform services on our behalf, including providers of website hosting, software, cloud storage, customer relationship management, analytics, security, communications, event administration, professional services, and technical support.
Advertising partners receive information through website advertising tags used for website-visitor audiences, retargeting, and conversion measurement. Selected HubSpot contact-list email addresses are also provided to AdRoll for advertising audiences and exclusions. These activities are described in Sections 6 and 10.
We disclose information to business, program, and event partners to administer the applicable relationship or activity, fulfill a request, or as described in an applicable notice.
AllyGPO sells event-related contact lists to sponsors, subject to applicable notices and privacy choices. Sponsors may use that information for follow-up and marketing in connection with events. Presenters, exhibitors, sponsors, and other event partners may also receive attendee information as described in applicable registration materials, event terms, or other notices.
We may disclose information to attorneys, auditors, accountants, insurers, consultants, and other professional advisers in connection with their services.
We may disclose information to governmental authorities, regulators, law enforcement, courts, counterparties, or other persons when we believe disclosure is required or permitted by law, necessary to exercise or defend legal rights, or appropriate to protect AllyGPO or others.
We may disclose information in connection with an actual or proposed merger, acquisition, financing, restructuring, sale of assets, bankruptcy, or similar transaction, subject to appropriate confidentiality protections where applicable.
We may disclose information when you request or direct us to do so or authorize the disclosure.
We and our service providers and advertising partners use cookies, pixels, tags, and similar technologies to operate the Services, remember preferences, understand website use, measure marketing activity, and conduct advertising.
Our cookie preference center organizes technologies into the following categories:
| Category | Purpose |
|---|---|
| Necessary | Technologies required to operate and secure the website, provide requested functions, and remember privacy choices. These cannot be disabled through the preference center. |
| Analytics | Technologies used to understand website traffic, visitor interactions, performance, and engagement. |
| Advertisement | Technologies used for conversion measurement, website-visitor audiences, retargeting, and advertising measurement. |
| Functionality | Optional technologies used to remember choices or provide enhanced features. |
We currently use or have used the following providers during the preceding 12 months:
Website-visitor audiences and contact-list audiences allow advertising to be displayed on other online services after an individual visits an AllyGPO website or is included in a selected advertising audience.
Use the Cookie Settings link in the website footer to accept or decline optional cookie categories and change your selections.
If you decline optional categories, nonessential cookies and tracking technologies assigned to those categories will be disabled. Necessary technologies remain active, including technologies used to operate the website, maintain security, and remember privacy choices.
Cookie selections generally operate on the browser or device where they are made. Clearing cookies, changing browsers, or using another device may require a new selection.
Use Do Not Sell or Share My Personal Information to opt out of applicable sales or sharing of personal information and processing for targeted advertising.
This opt-out covers event-related sponsor lists, website advertising activities, and identifiable contact information used for advertising audiences. Where necessary to apply a request to identifiable records, we may request an email address or other limited information needed to identify the applicable record.
Cookie Settings control browser-based technologies. To submit a request concerning identifiable information maintained outside that browser, including sponsor lists and contact-list advertising audiences, use Do Not Sell or Share My Personal Information.
We process legally recognized browser-based opt-out preference signals, including Global Privacy Control, as required by applicable law.
A recognized signal applies to the browser or device sending it and any consumer profile we associate with that browser or device. If we know the individual sending the signal, we also apply it to that individual’s identifiable records as required by law.
If we cannot associate your browser or device with your identifiable records, you may use Do Not Sell or Share My Personal Information and provide your email address to apply the request to those records, including event-related sponsor lists and contact-list advertising audiences. Providing that information is not required for us to honor the signal for the browser, device, or associated profile.
We display the status of recognized opt-out preference signals as required by law. You may also contact us to confirm whether an opt-out request concerning identifiable records has been processed.
The Digital Advertising Alliance opt-out and Network Advertising Initiative opt-out provide additional advertising choices. These tools are operated by third parties, may not affect every advertising activity, and do not necessarily constitute a privacy request submitted directly to AllyGPO.
Unsubscribe from promotional emails using the unsubscribe link in the message or by contacting us.
After unsubscribing, you may continue to receive nonpromotional communications concerning an account, event registration, business relationship, transaction, or legal or security matter.
AllyGPO does not currently operate a general marketing text-message program. If we introduce such a program, we will provide applicable disclosures and obtain any required consent.
Some browsers transmit a “Do Not Track” signal. Because there is no generally accepted standard for interpreting that signal, the Services may not respond to it. This does not affect our processing of legally recognized opt-out preference signals such as Global Privacy Control.
A sale, sharing, or advertising opt-out does not prevent processing or disclosures that do not constitute sale, sharing, or targeted advertising under applicable law.
AllyGPO may continue processing information as permitted by law to provide membership, GPO, technology, account, or other contracted services; administer programs and relationships; comply with legal obligations; or exercise legal rights. Applicable agreements, notices, privacy rights, and legal restrictions continue to govern those activities.
We retain personal information only for as long as reasonably necessary and proportionate for the purposes for which it was collected, including applicable legal, accounting, security, operational, and dispute-resolution requirements.
Retention periods depend on the information and its use:
| Information | Retention criteria |
|---|---|
| Website, analytics, and advertising information | The period needed to analyze website use, measure advertising, maintain preferences, and satisfy applicable provider settings and legal requirements. |
| Business contacts, inquiries, and communications | The duration of the relationship or reasonably anticipated business need, subject to applicable opt-outs and suppression records. |
| Account and authentication information | The period during which the account remains active, plus periods needed for support, security, dispute resolution, and legal compliance. |
| Event and program information | The period needed to administer and document the event or program, address requested accommodations, conduct appropriate follow-up, and satisfy legal and contractual obligations. |
| Event recordings and photographs | The period appropriate to the purpose described in applicable event materials, recording notices, or other terms. |
| Privacy requests and preferences | The period necessary to honor and document the request or preference and demonstrate compliance. |
| Litigation, investigation, and compliance records | The period reasonably necessary to address the matter, satisfy legal obligations, and preserve legal rights. |
Information held in backups may remain until deleted through ordinary backup cycles, subject to applicable law. We may retain lawfully deidentified or aggregated information for longer periods where permitted by law.
We use reasonable administrative, technical, and physical safeguards designed to protect personal information against accidental or unlawful loss, misuse, access, disclosure, alteration, and destruction.
No website, transmission, network, or storage system is completely secure. We cannot guarantee the absolute security of personal information. You are responsible for protecting your account credentials and notifying us if you suspect unauthorized access.
This section supplements the rest of this Privacy Policy. California residents have rights under the California Consumer Privacy Act, as amended (“CCPA”). Residents of other states may also have privacy rights under applicable law.
The rights available for a particular request depend on the applicable law, the information involved, and any applicable exceptions.
During the preceding 12 months, we collected the following categories of personal information, as applicable to the interaction involved:
| Statutory category | Information involved |
|---|---|
| Identifiers | Names, email addresses, telephone numbers, account or user identifiers, and online identifiers associated with website use and advertising audiences. |
| Personal records | Contact information and other information provided through business communications, registrations, and requests. |
| Commercial information | Records concerning memberships, products, services, programs, event registrations, attendance, inquiries, and related business interactions. |
| Internet or other electronic network activity | Website visits, pages viewed, website and advertising interactions, referring sources, and conversion activity. |
| Audio, electronic, visual, or similar information | Event, meeting, and webinar recordings and photographs covered by applicable notices or terms. |
| Professional or employment-related information | Employer or practice name, specialty, job title, professional role, business contact information, and business-relationship information. Workforce and applicant information is addressed separately in the California HR Data Privacy Policy. |
| Sensitive personal information | Account login credentials and sensitive information voluntarily provided for requested event accommodations. |
The categories of sources are described in Section 3, collection and use purposes in Section 4, recipient categories in Section 5, and retention criteria in Section 8.
During the preceding 12 months, we disclosed information in these categories to service providers and contractors, as applicable, for website operations, communications, customer relationship management, analytics, event administration, account administration, security, and other business purposes described in Sections 4 and 5.
AllyGPO sells event-related contact lists to sponsors. The advertising activities described below also involve disclosures treated as sale, sharing, or targeted advertising under applicable state privacy laws, even when no money is exchanged.
During the preceding 12 months, we have sold or shared, as those terms are defined by applicable law, the following categories of personal information:
| Category sold or shared | Information involved | Recipient category | Purpose |
|---|---|---|---|
| Identifiers | Email addresses from selected HubSpot contact lists. | AdRoll. | Advertising to prospect practices and managing advertising audiences and exclusions. |
| Identifiers | Online identifiers associated with website visitors. | Advertising platforms, including Google Ads, LinkedIn, and AdRoll. | Creating website-visitor audiences and retargeting website visitors. |
| Internet or electronic network activity | Website visits and interactions used for website-visitor audiences, retargeting, and conversion measurement. | Advertising platforms, including Google Ads, LinkedIn, and AdRoll. | Website-visitor retargeting and audience creation; conversion measurement through Google Ads and LinkedIn. |
| Identifiers | Contact information included in event-related sponsor lists. | Event sponsors. | Sponsor follow-up and marketing in connection with events. |
AllyGPO does not currently upload contact lists to Google Ads or LinkedIn. A Meta pixel previously loaded through AdRoll’s configuration until approximately September 2026. AllyGPO did not run Meta advertising campaigns.
You may opt out of applicable sale or sharing by selecting Do Not Sell or Share My Personal Information. Additional information about privacy choices and Global Privacy Control appears in Section 7.
We do not have actual knowledge that we sell or share the personal information of individuals under 16 years of age.
We use sensitive personal information for account administration and security, requested event accommodations, compliance with law, and other purposes permitted without providing a separate right to limit under California law.
We do not use or disclose sensitive personal information to infer characteristics about individuals for unrelated purposes or for purposes requiring a separate right to limit under California law. If our practices change, we will provide the required notice and choice.
Depending on applicable law, you may have the right to:
These rights are subject to applicable exceptions and limitations. For example, we may retain information necessary to provide a requested service, complete a transaction, maintain security, satisfy legal obligations, exercise legal rights, or fulfill another permitted purpose.
To submit a request to know, access, correct, delete, or obtain a portable copy of personal information:
To opt out of sale, sharing, or targeted advertising:
You do not need to create an account to submit an opt-out request. We do not require identity verification for a sale, sharing, or targeted-advertising opt-out, although we may request information reasonably necessary to apply the request to identifiable records.
For access, correction, deletion, or portability requests, we may take reasonable steps to verify your identity and authority. The information requested will depend on the nature and sensitivity of the request. We use information supplied for verification only for verification, security, fraud prevention, and legal compliance.
You may designate an authorized agent to submit a request where permitted by law. We may request evidence of the agent’s authority. For access, correction, deletion, or portability requests, we may also require you to confirm your identity or authorization directly, except where prohibited by law.
We respond within the periods required by applicable law. If we cannot fully honor a request, we will provide the explanation required by law.
If we deny a request, you may appeal by emailing privacyofficer@AllyGPO.com with the subject line “Privacy Appeal” and identifying the decision you are appealing. If an appeal is denied, we will explain the decision and, where required, provide information about contacting your state attorney general.
California Civil Code Section 1798.83 permits certain California residents to request information concerning specified disclosures of personal information to third parties for their own direct-marketing purposes.
Submit a request by emailing privacyofficer@AllyGPO.com with the subject line “California Direct Marketing Request.” Requests may be made once per calendar year.
We do not currently offer a financial incentive or price or service difference based on the collection, sale, sharing, or retention of personal information. If we offer such a program, we will provide the disclosures and choices required by applicable law.
We may create, use, and disclose information that has been lawfully aggregated or deidentified so that it cannot reasonably be linked to an individual or household.
Where required by law, we maintain deidentified information in deidentified form and do not attempt to reidentify it except to determine whether our deidentification processes comply with applicable requirements.
This Section does not expand our rights to use information governed by a separate agreement.
The Services may contain links to or integrations with third-party websites, applications, platforms, and services. Third parties may collect information directly from you and process it under their own privacy policies and terms.
Except where applicable law provides otherwise, AllyGPO is not responsible for the privacy, security, or other practices of third parties that we do not control. Review their policies before providing information.
AllyGPO is based in the United States, and the Services are intended primarily for a U.S. audience.
If you access the Services from outside the United States, information you provide may be transferred to and processed in the United States, where privacy laws may differ from those where you reside.
The Services are intended for adults in professional and business audiences and are not directed to children.
We do not knowingly collect personal information online from children under 13. If we learn that a child under 13 has provided personal information through the Services, we will take reasonable steps to delete it. A parent or guardian who believes a child has provided personal information may contact us using the information below.
We do not knowingly sell or share the personal information of individuals under 16.
We may update this Privacy Policy to reflect changes in our practices, Services, or legal obligations. The Effective Date at the top identifies when the current version took effect.
Changes apply prospectively when the revised Privacy Policy is posted, unless another effective date is stated. Where required by law, we will provide additional notice or obtain consent before applying a material change to previously collected personal information.
Questions, concerns, complaints, and privacy requests may be directed to:
AllyGPO, LLC
Attn: Privacy Officer
5 Cowboys Way, Suite 300
Frisco, TX 75034
Telephone: 1-866-255-9476
Email: privacyofficer@AllyGPO.com